AIKIDO-2026-552135

TL;DR

The napi runtime routes deferred cleanup of owned Buffer and TypedArray values through a single process-global custom-GC threadsafe function created by the first isolate that loads the addon. Because that path carries no owning env, a value dropped off its owning JavaScript thread under worker_threads has its napi_ref unreferenced and deleted through another isolate's environment, producing a cross-isolate use-after-free on V8 global handles. This can abort the Node.js process or corrupt memory when an async function consumes a Buffer or typed array across worker isolates. The fix gives each environment its own custom-GC handle so cross-thread drops are routed through the value's owning isolate.